TOP SECRET//SI//INOFORN 


£e IS Special Source Operations 


» z 一 sg i v X 
σα ANTT — PE ; 


SSOC 


d 


ollection Optimization 


Core SSO Team: 


TOP SECRET//SI//INOFORN 


TOP SECRET//SI//NOFORN 


Address Books 


* Email address books for most major webmail are collected as 
stand-alone sessions (no content present") 


* Address books are repetitive, large, and metadata-rich 
* Datais stored multiple times (MARINA/MAINWAY, PINWALE, CLOUDs) 
* Fewer and fewer address books attributable to users, targets 


* Address books account for ~ 22% of SSO’s major accesses (up 
from ~ 12% in August) 


Access (10 Jan 12) Total Sessions Address Books 7 Provider Collected Attributed Attributed% 
US-3171 1488453 237067 (1696 of traffic) Yahoo 444743 11009 2.4896 
DS-200B 938378 311113 (33% of traffic) Hotmail 105068 1115 1.0696 
US-3261 94132 2477 (396 of traffic) Gmail 33697 2350 6.9796 
US-3145 177663 29336 (1696 of traffic) Facebook 82857 79437 95.8796 
US-3180 269794 40409 (15% of traffic) Other 22881 1175 5.1496 
US-3180 (16 Dec 11) 289318 91964 (3296 of traffic) TOTAL рки enge 19 90У 
TOTAL 3257738 712366 (22% of traffic) 
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Enabled in SCISSORS for various SSO sites: 
— JPMQ (metadata: QMPJ) - DS-200B (MUSCULAR) 
— DGOT (metadata: TOGD) - US-3171 (DANCINGOASIS) 
— DGOD (metadata: DOGD) - US-3171 (DANCINGOASIS) 
— SPNN (metadata: NNPS) - US-3180 (SPINNERET) 
— EGLP (metadata: PLGE) - US-3145 (MOONLIGHTPATH) 
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Address Books 
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Selector Detasks 


Emergency Detasks 


Nov-11 Dec-11 Jan-12 Feb-12 Mar-12 Apr-12 May-12 
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So What? 


* Store less of the wrong data 
— 20% reduction (so far) in content to long-term repositories 
— Data still resides at site for SIGDEV 
* Increase data variety 
— Hole left by “wrong data” filled with more "right data" 
— More signals and case notations can be tasked at site 
e Shifting collection philosophy at NSA 


— “Memorialize what you need" versus “Order one of 
everything off the menu and eat what you want” 


WIKI: https://wiki.nsa.ic.gov/wiki/Collection Optimization 
XKEYSCORE: fingerprint/defeats/atrouter and fingerprint/defeats/atxks 
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